Who we are
Doceva LLC, United States, operates Receptionistic and is responsible for account, website, enquiry, and public-demo information. Contact our privacy team at privacy@receptionistic.com or use our request form. Our public mailing address has not yet been published; please use these digital contact routes.
When a business uses our concierge for its callers, that business generally decides why caller information is collected and acts as the controller or responsible organisation. We process that information to provide its configured service. Ask the business you called about its privacy practices; we can help route a request that relates to its workspace.
Information we collect and where it comes from
- Accounts and authentication: your name, email, password hash, session records, and account settings. If you add a passkey, we store its public credential and device metadata. Your device’s biometric template and passkey private key are not sent to us. If you choose an available third-party sign-in option, we receive the profile and account identifier needed for sign-in.
- Owner verification: when identity verification is required for outbound calling, the workspace owner completes a hosted check with Didit. Didit handles the identity documents and any selfie or liveness checks requested by the configured workflow. Receptionistic processes the result and keeps verification status, session and workflow references, owner association, and verification, expiry, and event timestamps. A link for resuming an unfinished check is stored encrypted. Our integration does not save identity-document images, biometric media, or the full verification decision.
- Business information: the business name, website, opening hours, time zone, greeting, knowledge entries, and team phone number you provide. This includes website pages or text files you choose to import, products, services, prices, FAQs, and your country and preferred local number area code.
- Conversations: microphone audio you choose to send, its transcript, AI replies, and call details. A business workspace may also contain caller names, phone numbers, contact details, appointment information, and notes supplied by callers or the business.
- Sales follow-ups: lead names, company and contact details, goals, call context, legacy permission records, no-call preferences, lead stages, follow-up times, and notes supplied by a business or agreed during a conversation. Businesses use these records to respond to enquiries and arrange the next step.
- Enquiries and requests: the contact details and message you submit, any plan selection, and the reference and status of a privacy or accessibility request.
- Technical information: network IP addresses needed to deliver and protect the service, session and security information, and a browser identifier for the free demo. The monthly demo ledger stores keyed hashes of the IP and browser identifier, together with usage and session times. These are pseudonymous identifiers, not anonymous information. Hosting infrastructure may process network and security logs.
We do not currently collect payment-card details on the site. We do not use advertising pixels, behavioural analytics, or session replay. See the cookie notice for storage details.
The voice demo is an AI conversation at a fictional business. Please use fictional details and avoid sensitive information. Browser audio is sent for transcription, conversation text is processed to generate a reply, and reply text is converted to speech. Our application does not save raw microphone audio as a recording; transcripts and generated reply audio are handled as described below. Our processing suppliers also handle the information needed for these steps.
Why we use information
| Purpose | Basis |
|---|---|
| Create an account, deliver the requested concierge service, and respond to a setup enquiry | Steps at your request before a contract and performance of the service contract. For business representatives, our legitimate interest in administering the business relationship. |
| Protect accounts, prevent misuse, and enforce the five-minute public-demo allowance | Our legitimate interest in security, fraud prevention, and fairly allocating the free service, subject to your rights. |
| Handle privacy requests and comply with binding legal requirements | Legal obligations where applicable; otherwise our legitimate interest in responding to and documenting requests. |
| Process optional information or an activity for which the law requires consent | Your informed consent for that particular activity. You can withdraw it without affecting the lawfulness of earlier processing. |
Business clients must establish the appropriate basis for processing their callers’ information and provide any required AI, transcription, or recording notice and consent process. Browser microphone permission controls device access; it is not a substitute for all legally required notices or consents.
Required account and request fields enable us to provide the corresponding service or respond. You can browse without creating an account or starting a call. We do not use personal information for targeted advertising or sell or share it for cross-context behavioural advertising. No advertising consent is bundled into registration.
The concierge can make mistakes. It helps with answers, routing, and appointments; it is not intended to make legal or similarly significant decisions about people. Contact the relevant business for a person or to correct an answer.
Who receives information and international processing
Information is made available to the business whose workspace or call you use, authorised personnel, and service providers needed for hosting, database storage, security, speech recognition, conversational processing, and speech generation. A sign-in provider receives information when you choose its sign-in flow. Where telephone service is activated, telecommunications providers process calls and delivery details. We may disclose information where a binding legal requirement applies or where necessary to protect rights and investigate misuse.
Doceva LLC is based in the United States. Infrastructure and processing suppliers may handle information outside your country, including in the United States. We do not offer an EU-only data-residency commitment through this website. Before business use involving restricted international transfers, request the relevant processing agreement, recipient details, locations, and applicable transfer safeguards from privacy@receptionistic.com. This notice itself is not a transfer agreement or a promise that a particular safeguard is already in place.
We do not use your conversations to train our own general-purpose model. This is not a promise about every supplier’s retention or training practices; contact us for the arrangements applicable to your proposed business deployment. See data processing.
How long information is kept
- Website and file scan previews: unreviewed scans expire after one hour and are removed by scheduled cleanup or the next scan. Information you apply is kept as workspace content until removed through the available controls or a deletion request.
- Account and business records: kept to operate the workspace and handle relevant contractual, security, and legal obligations. There is currently no automatic account or call-transcript deletion schedule. You can edit or remove supported workspace entries, export workspace data, or request deletion. Any lawful exception or necessary retention must be assessed when a request is handled.
- Public-demo conversations: the server session and transcript are deleted when an end-call request is received. Expired sessions are removed by the next demo quota cleanup. The free conversation is limited to five minutes; a browser close or network interruption may prevent an immediate end request.
- Demo usage: current and previous UTC calendar months are kept in the usage ledger; older months are removed during subsequent quota activity. The browser cookie lasts up to 35 days when set by this version of the site.
- Generated reply audio: private conversation audio expires after 30 minutes; reusable public sample audio after 24 hours. Expired cached files are removed during subsequent synthesis cleanup. Telephone playback tokens, where used, expire after 15 minutes. Expiration means the application stops serving the item, not necessarily that every stored copy has already been erased.
- Sign-in: sessions expire after seven days. One-time authentication challenges expire after five minutes and are consumed on use. Expired server records are cleaned up during relevant service activity.
- Owner verification: verification references and status history are kept with the workspace to enforce outbound-call eligibility and investigate verification issues; no automatic purge is currently configured. Account exports include this metadata. Didit’s document and biometric processing and retention are described in its Verification Privacy Notice. Contact us about an incorrect result or a deletion request.
- Enquiries, rights requests, and supporting records: retained for response, follow-up, and relevant legal obligations; no automatic purge is currently configured. Request deletion or ask about the records relevant to you.
Supplier logs and backup copies can have separate retention. Ask us for the arrangements applicable to your use; we do not represent the application expiry periods as verified deletion deadlines for every supplier or backup.
Your choices and rights
Depending on the law that applies to you, you may request access, a copy, correction, deletion, portability, restriction, or objection to processing. You may withdraw consent where processing depends on consent, and appeal a decision where applicable. Use our privacy request form or email privacy@receptionistic.com. You do not need an account to submit a request. Account holders can also download their workspace data from Settings.
Describe the right you wish to exercise and enough context to locate relevant records. We may need proportionate identity or authority checks before disclosing or changing information, and may need to refer a caller request to the relevant business. Do not send passwords, identity-document scans, payment details, or unrelated sensitive information through the initial form. Opt-out signals do not require an account or identity-document upload.
We aim to respond within the deadline required by applicable law and explain any permitted extension or refusal. Requests are not treated as completed simply because you receive a reference. You can ask for an explanation, appeal using the same contact routes, and complain to the appropriate data-protection or privacy regulator. We do not penalise you for exercising an applicable privacy right.
We recognise Global Privacy Control and Do Not Track in the privacy controls. Optional tracking stays off for everyone. to review this browser’s acknowledgement.
Information for Europe and North America
EEA, United Kingdom, and Switzerland
The purposes, bases, recipient categories, retention information, and rights above apply subject to the law that covers your circumstances. You may complain to your competent supervisory authority, the UK Information Commissioner, or the Swiss Federal Data Protection and Information Commissioner, as appropriate. You may object to legitimate-interest processing; rights and exceptions depend on the applicable law and processing involved.
United States
Applicable state laws may give you rights to know or access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising, or certain profiling. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. The categories collected, purposes, sources, and recipient categories are described above. An authorised agent may submit a request; proof of authority may be needed. Use the request form for an opt-out or appeal. State-law coverage and exemptions vary.
Canada, including Québec
You can ask about our privacy practices and access or correct your information through privacy@receptionistic.com. Where consent applies, you can withdraw it subject to applicable contractual or legal restrictions, which may affect the service requested. Information may be processed outside Canada or Québec. You may raise unresolved concerns with the appropriate federal or provincial privacy authority.
Mexico
Where applicable, you may exercise access, rectification, cancellation, and opposition (ARCO) rights, withdraw consent, or request limits on use or disclosure using our request form or privacy email. Identify the requested action and the relevant information. We will explain any necessary verification and applicable response procedure. The legal operator is Doceva LLC; its mailing address remains pending publication.
Children, security, and notice changes
The service is intended for business users aged 18 or over, not as a service directed to children. Do not deliberately submit children’s information or sensitive health, financial, or identity information through the public demo. Contact us if you believe such information has been submitted so we can assess removal.
The application uses HTTPS in production, authenticated workspace access, hashed passwords and session tokens, and access checks between workspaces. No system is risk-free. These controls are not a security certification or a guarantee against unauthorised access.
We will publish changes to this notice here with an updated date. New uses that require consent will need a separate valid choice before they begin. Contact privacy@receptionistic.com for questions, accessible formats, or a privacy request.